CVE-2026-14290

Name of the Vulnerable Software and Affected Versions Embed Google Photos album WordPress plugin versions prior to 2.2.2

Description Users with the Contributor role or higher can perform a stored cross-site scripting (XSS) attack. This occurs because the plugin fails to escape a shortcode attribute value before it is output within an HTML attribute, enabling the injection of arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post.

Recommendations Update the plugin to a version newer than 2.2.1.